CVE-2026-25177

Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Scoring

Severity

HIGH

CVSS base score

8.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS probability

1.28%

CWE

CWE-641

Published

2026-03-10

Last modified

2026-06-20

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Microsoft Windows 11 version 22H3
• Microsoft Windows 11 Version 23H2
• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2

Weakness type

• CWE-641

Related vulnerabilities

• CVE-2026-46581 — In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...
• CVE-2026-50510 — GitHub Copilot Remote Code Execution Vulnerability
• CVE-2026-50023 — yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
• CVE-2019-25623 — Luminance Studio 2.17 Denial of Service via Malformed Input
• CVE-2025-47173 — Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-47953 — Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-47260 — 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did...
• CVE-2025-21402 — Microsoft Office OneNote Remote Code Execution Vulnerability

Markdown version · Browse all CVEs